Buying a bank: change of control and qualifying holdings

Acquiring an existing bank or regulated financial firm can be faster than building one, but it is never a way around the regulator. In every major financial centre, the buyer of a meaningful stake must obtain the supervisor’s approval before closing, and the buyer is examined almost as closely as a new licence applicant.

This guide explains the EU framework in detail, because it is the most codified, and compares it with the UK, Hong Kong and Switzerland. The same logic applies to e-money institutions, payment institutions, investment firms and insurers, with sector-specific variations.

What triggers approval

The core concept is the qualifying holding: a direct or indirect holding that represents 10% or more of the capital or voting rights of a financial firm, or that makes it possible to exercise significant influence over its management.

Under Article 22 of the Capital Requirements Directive (CRD), anyone who has decided to acquire a qualifying holding in a credit institution, or to increase it so that it reaches or exceeds 20%, 30% or 50%, or so that the bank becomes its subsidiary, must notify the competent authority in writing in advance. Disposals and reductions below those thresholds must also be notified under Article 25, and banks must report changes they become aware of under Article 26.

The Payment Services Directive (Article 6) applies the same thresholds to payment institutions and refers back to the CRD for the information required. Investment firms and insurers follow parallel rules, and all three sectors share one set of Joint Guidelines issued by the EBA, EIOPA and ESMA (JC/GL/2016/01), which have applied since 1 October 2017.

Indirect holdings and acting in concert

Approval is needed at every level of the ownership chain, not only for the company that signs the share purchase agreement. The Joint Guidelines use two tests:

1. The control criterion. Anyone who controls an entity that holds a qualifying holding is treated as indirectly acquiring that holding in full.
2. The multiplication criterion. Where there is no control, the percentages along the chain are multiplied; if the result is 10% or more, an indirect qualifying holding is acquired.

The ECB’s Guide on qualifying holding procedures states that in multi-layer structures “all indirect proposed acquirers for each layer” must notify individually, with no exception for intermediate holding companies. Persons acting in concert, for example under a shareholders’ agreement on voting, have their holdings aggregated.

Who decides

Jurisdiction	Approving authority	Legal basis
Euro area banks	ECB, on a proposal from the national supervisor	CRD Articles 22 to 27 and the SSM Regulation
Other EU banks and financial firms	National competent authority	CRD, PSD2, MiFID II, Solvency II as transposed
United Kingdom	PRA for dual-regulated firms; FCA for solo-regulated firms	FSMA Part XII (section 178 notices)
Hong Kong	HKMA, for locally incorporated authorised institutions	Banking Ordinance section 70
Switzerland	FINMA	Banking Act, qualified participation rules

In the euro area, the ECB decides on qualifying holdings in all credit institutions, including the less significant banks it does not supervise directly. Its authorisations page states the assessment period as 60 working days, extendable to a maximum of 90.

The timeline

The CRD sets a precise clock, which national laws may not make stricter:

1. Acknowledgement. The supervisor acknowledges receipt of the notification in writing within two working days and states the date the assessment period will expire.
2. Assessment period. The supervisor has a maximum of 60 working days from that acknowledgement, provided all required documents were attached.
3. Information requests. Up to the 50th working day, the supervisor may request further information. The clock is suspended until the answer arrives, for no more than 20 working days.
4. Extended suspension. The suspension can be extended to 30 working days where the acquirer is situated or regulated outside the EU, or is not itself subject to EU financial supervision.
5. Decision. If the supervisor opposes, it must say so in writing within two working days of completing the assessment, with reasons. If it does not oppose within the period, the acquisition is deemed approved.
6. Completion. The supervisor may fix a maximum period within which the acquisition must be concluded.

In practice, the clock only starts once the file is complete, and assembling a complete file for a complex buyer can take months. The ECB encourages pre-notification discussions “to clarify information requirements, timelines and how to address potential supervisory concerns early on in the process.”

In the UK, the PRA likewise has 60 working days from acknowledging a complete notification to approve, approve with conditions or propose to object. The PRA states that inserting a new holding company requires prior approval even if the ultimate controller does not change, and that acquiring or increasing control without approval is a criminal offence under section 191F of FSMA.

What the supervisor assesses

CRD Article 23 sets five criteria, which the supervisor applies “having regard to the likely influence of the proposed acquirer”:

Criterion	What it means in practice
(a) Reputation of the acquirer	Integrity, criminal and regulatory record, and professional competence
(b) The new management	Reputation, knowledge, skills and experience of anyone who will direct the bank after the deal
(c) Financial soundness	Whether the acquirer can finance the deal and support the bank over time
(d) Prudential compliance	Whether the bank will continue to meet capital, liquidity, governance and group supervision requirements
(e) Money laundering risk	Whether there are reasonable grounds to suspect ML/TF, or that the deal could increase that risk

Article 23 also limits the supervisor. It may oppose only on reasonable grounds under these criteria or because the information is incomplete, and it may not examine the deal in terms of “the economic needs of the market”.

Business plan and financing

Where the buyer will control the bank, the ECB expects a business plan with projected financial statements “for at least three years after the proposed acquisition”. The Joint Guidelines state that borrowed funds do not in themselves make an acquirer unsuitable, but the supervisor will assess whether the debt weakens the acquirer or the bank’s ability to meet prudential requirements.

The ECB is more pointed about leverage. It gives “particular attention” to acquisition debt, because of the risk that the new owner will raise the bank’s risk profile or extract dividends to service that debt. It identifies private equity firms, sovereign wealth funds and conglomerates as “specific acquirers” whose structures and strategies need close review.

Source of funds

The Joint Guidelines (paragraph 14.5) set the standard for the money used in the deal. Supervisors should verify that:

• the funds pass through financial institutions subject to effective AML supervision in the EU or in countries that apply the FATF standards;
• the explanation of how the funds were generated is credible and consistent with the value of the deal; and
• the funds have “an uninterrupted paper trail back to their origins”, or other information that resolves doubts about their legal origin.

Links to jurisdictions on the FATF or EU high-risk lists call for particular attention, and supervisors may oppose a deal where the context gives reasonable grounds to suspect increased ML/TF risk even without any criminal record.

Conditions and commitments

Supervisors may approve subject to conditions precedent, which must be met before closing, or obligations, which apply afterwards. The ECB also accepts commitments from acquirers, such as maintaining the bank’s capital ratios or providing liquidity support. The HKMA generally requires all controllers of locally incorporated banks to give a letter of comfort committing to provide capital or liquidity support in case of need.

Jurisdiction differences

• Hong Kong. The HKMA approves controllers of locally incorporated authorised institutions under section 70 of the Banking Ordinance, distinguishing minority shareholder controllers (10% to 50% of voting rights) from majority controllers. Its stated policy is that a person intending to hold 50% or more should generally be “a well established bank or other supervised financial institution in good standing”.
• Switzerland. Changes in qualified participations must be reported to FINMA, and a bank that becomes foreign-controlled must show reciprocal rights in the countries where its qualified participants are domiciled.
• EU banks as buyers. Since the amended CRD (Directive (EU) 2024/1619) took effect, an EU bank planning to acquire a material holding, defined as 15% or more of its own eligible capital, must also notify its own supervisor in advance under new Article 27a, with a parallel 60 working day assessment.

Due diligence for buyers

Regulatory approval is only half the work. The buyer also needs to understand what it is acquiring. Areas specific to regulated targets include:

1. Licence scope. The exact permissions held, any restrictions or conditions, and which EU passports or cross-border notifications are in place.
2. Supervisory record. Inspection reports, findings, remediation plans, capital add-ons and any pending enforcement. Ask the seller to authorise disclosure where confidentiality rules allow.
3. Capital and liquidity. Current ratios, buffers, Pillar 2 requirements and the capital the business plan will need after closing.
4. AML and sanctions. Quality of customer files, past suspicious activity reporting, legacy high-risk customers and any regulatory AML findings. Inherited AML problems become the buyer’s problems.
5. Correspondent and payment access. Which correspondent banks and payment schemes the target uses, and whether they will continue after a change of owner.
6. Systems and outsourcing. Core banking platform, critical vendors and contractual change-of-control clauses.
7. People. Whether key function holders will stay, and whether new directors will pass fit and proper review.

What drives value

There is no official valuation method for a banking licence, and price depends on the specific deal. The drivers buyers usually weigh include:

• the breadth of permissions and passports, compared with the time and cost of obtaining them from scratch;
• a clean supervisory record and AML history;
• a stable deposit base and existing customer relationships;
• surplus capital above requirements, or conversely a capital shortfall the buyer must fund;
• working correspondent banking and payment scheme access;
• functioning systems, controls and staff who can pass fit and proper review.

A licence with no business, no staff and unresolved findings has limited value, because the buyer will still face a full assessment and must then build the bank anyway.

Red flags: shells and “account-only” companies

Offers of “ready-made” banks, dormant licensed shells or “companies with a bank licence and account” circulate widely, especially for offshore jurisdictions. Treat them with caution.

• Approval is still required. A change of control of a licensed entity triggers the same review of the buyer, the source of funds and the business plan described above. There is no shortcut that avoids it.
• Unused licences can be withdrawn. Under CRD Article 18, a supervisor may withdraw a licence not used within 12 months, or where the bank has ceased business for more than six months.
• Shell banks are cut off. EU law defines a shell bank as an institution incorporated where it has no physical presence involving meaningful mind and management, and unaffiliated with a regulated group. Credit and financial institutions are prohibited from entering into correspondent relationships with one, so such an entity cannot reach the payment system.
• Undisclosed owners. Any structure that hides beneficial owners, uses nominees, or cannot document the origin of funds will fail the source of funds test.
• Closing before approval. Any seller who proposes to transfer control before the supervisor approves is proposing a breach of law, which in the UK is a criminal offence.

A credible seller of a regulated firm will expect the buyer to engage with the supervisor early and will build the regulatory timeline into the contract, usually as a condition precedent to closing.